Watershed Customer Information System - December 2009

We undertook this audit because the city’s financial auditor noted control deficiencies related to watershed management’s customer informationsystem in the fiscal year 2007 and 2008 audited financial statements. In this audit we examined the extent to which the system addressed billing and collections problems noted in previous audits.

We found:

7 of 97 requirements we tested were not implemented.

Key system settings failed to enforce watershed management’s security policy, allowing users to set passwords that were shorter than required and for some users to keep the same passwords indefinitely.

Several former employees retained system access

The department allows system access through generic accounts not assigned to an individual.

Despite these efforts, the amount of time it takes to collect on the accounts has remained high. The average collection period for 2005 was 106 days, 81 days past the bill’s due date of 25 days.

The department has not established a formal change control policy for the enQuesta application and over relies on its contractor for system security and change management